What is the CAC? China's cyberspace regulator, explained

ai Oct 22, 2026 4 min read Caybles Research Desk

TL;DR

The Cyberspace Administration of China (CAC, 国家互联网信息办公室) is the central authority governing China's internet, data and AI policy — the body behind the generative AI measures, content-labelling rules, algorithm regulations and cross-border data transfer assessments that define compliance for any tech company operating in or with China. Established in its modern form in 2014, it answers to the Communist Party's Central Cyberspace Affairs Commission while operating as a State Council agency, and it almost always issues rules jointly with sectoral ministries. If a Chinese tech regulation has one signature on it, that signature is usually the CAC's.

The Cyberspace Administration of China (CAC) is the country's central regulator of the internet, data governance and, increasingly, artificial intelligence. In Chinese it is most often called 网信办 — wangxinban — and its formal name, the National Cybersecurity Administration or Office of the Central Cyberspace Affairs Commission, describes the duality that defines it: it is simultaneously a State Council government agency and the staff office of the Communist Party body that sets cyber policy at the top of the system. That dual identity explains both its power and its style, and it is why the CAC's name appears on nearly every significant piece of Chinese technology regulation of the past decade.

Where the CAC sits in China's system

The modern CAC took shape in 2014, when the party's central leading group on cybersecurity and informatization — chaired at the very top of the leadership — was given a permanent office, according to the institutional histories that mark that year as the founding of China's current internet governance structure. The arrangement concentrates authority that in other systems is dispersed across regulators, courts and industry bodies.

Two structural facts matter for outsiders. First, the CAC's remit is horizontal: content, data, algorithms, AI, platform conduct and cross-border data flows all fall within its portfolio, which makes it the closest thing China has to a general-purpose technology regulator. Second, it rarely legislates alone. The generative AI measures were issued with the industry and science ministries; the content-labelling measures with the public-security ministry among others; and sectoral rules typically carry the signatures of whichever ministries own the affected industry. Reading a Chinese regulation therefore starts by reading its signatories — a habit our CAC versus MIIT comparison explores in the context of the EU AI Act.

What the CAC actually regulates

In practice, the CAC's portfolio spans the full life of data and content in China:

Content governance — the licensing, real-name registration and takedown regime that governs what may be published online and by whom.
Algorithmic systems — the 2022 recommendation-algorithm rules, which require registration and give users rights to opt out of personalised recommendations.
Synthetic and generated media — the deep-synthesis rules of 2023 and the generative AI measures of August 2023, which established the filing-and-assessment pathway for public-facing AI services; more on that pathway in our China–EU comparison.
AI content labelling — binding measures effective September 2025 requiring labels and watermarks on AI-generated content.
Cross-border data flows — security assessments and standard contracts required under the Data Security Law and PIPL before defined categories of personal and important data may leave China.
Interactive and human-like AI — draft measures on chatbots, companions and virtual humans, published for comment in December 2025, extend the framework to psychologically sensitive applications, as China Law Translate's drafting and Mayer Brown's analysis describe.

Why foreign companies encounter the CAC first

Three gates make the CAC the first Chinese regulator most international teams meet. Market access: public-facing generative AI services in China proceed through CAC filings and security assessments before launch. Data: any transfer of regulated personal or important data out of China requires a CAC-administered process. And procurement: as the DeepSeek restriction wave across Western governments shows — analysed in our EU compliance piece — the data pathway that Chinese rules mandate is now itself a screening question in foreign markets, which puts CAC regulations at the centre of decisions made far outside China.

How to follow CAC publications

The CAC publishes on its own site, in Chinese, with the operative text always authoritative there. For teams that need the flow without the language, the Caybles policy tracker scrapes the CAC feed — alongside MIIT, NDRC and MOFCOM — every thirty minutes, classifies each item by policy area, and machine-translates it into English while preserving the original; the MCP server exposes the same feed to AI agents. Analysis of what CAC documents mean, as opposed to what they say, is what Signal exists for.

Frequently asked questions

Is the CAC the same as MIIT?

No. The CAC governs internet, data and content policy across the economy; MIIT owns industrial policy, telecoms and manufacturing, including semiconductor supply chains. The two sign joint rules where their remits overlap, which is frequently.

Is the CAC a government agency or a party body?

Both, by design. It operates as a State Council agency while serving as the office of the party's Central Cyberspace Affairs Commission, which is why its decisions carry authority across government and industry alike.

Do CAC rules apply to companies outside China?

The rules attach to services provided within China and to data processed there. Their influence abroad is indirect but substantial: compliance expectations, procurement screens and standards debates worldwide now reference the Chinese framework.

Where can I read CAC documents in English?

Machine-translated copies, tracked continuously and linked to the Chinese originals, are in the policy tracker. For legal-grade translation, China Law Translate and similar projects publish bilingual texts for the major instruments.

Sources

Not advice. This article is published for general information and analysis only. It is not legal, regulatory, investment or professional advice, and it should not be relied upon as such — please do your own due diligence and consult qualified counsel for your specific situation. Regulatory positions described here may have changed since publication.